Technical information
Malicious functions:
Executes code of the following detected threats:
- Adware.Leadbolt.9.origin
Modified file system:
Creates the following files:
- <Package Folder>/.cache/<Package>
- <Package Folder>/.cache/classes.dex
- <Package Folder>/.cache/classes.jar
- <Package Folder>/.md5
- <Package Folder>/.sec_version
- <Package Folder>/files/apps_banner.dex
- <Package Folder>/files/apps_banner.jar
- <Package Folder>/files/apps_insert.dex
- <Package Folder>/files/apps_insert.jar
- <Package Folder>/files/apps_pop.dex
- <Package Folder>/files/apps_pop.jar
- <Package Folder>/shared_prefs/BOX_CONFIG.xml
Miscellaneous:
Executes next shell scripts:
- <Package> <Package> -1829995304 0 /data/app/<Package>-1.apk 39 <Package> 44 45
- <Package> <Package> -1829995304 0 /data/app/<Package>-1.apk 39 <Package> 45 46
- <Package> <Package> -1831060264 0 /data/app/<Package>-1.apk 39 <Package> 44 45
- chmod 755 <Package Folder>/.cache/<Package>
Loads the following dynamic libraries:
- libsecexe.x86
Uses special library to hide executable bytecode.
Displays its own windows over windows of other applications.
